Firewalls and VPNs under attack: SonicWall, Barracuda and Check Point updates to install now

In the first half of November 2026 three makers of widely used security appliances confirmed ongoing attacks against their devices: SonicWall (firewalls and VPN), Barracuda (email gateways and other appliances) and Check Point (firewalls). The US agency CISA added the flaws to its catalog of exploited vulnerabilities on 6, 10 and 13 November.

Firewalls, VPNs and spam filters sit on the border between the internet and the office network. If they are compromised, the attacker is already inside. For a Ticino SME the practical question is simple: which device do we have, which version is it running, and who updates it?

SonicWall: the VPN can bypass multi-factor authentication

In advisory SNWLID-2026-0014 SonicWall fixes seven vulnerabilities in SonicOS, the system of its Gen7 and Gen8 firewalls (TZ, NSa, NSsp and NSv series). According to the vendor one of them, CVE-2026-19868, may already be exploited: if SSL VPN logins use SAML, a user with valid credentials for another authentication method (for example LDAP or RADIUS configured on the firewall) can bypass the SAML controls and with them multi-factor authentication. SonicWall rates it CVSS 7.1 and states that it only affects those using SAML for VPN logins.

The other fixes concern the management interface (two flaws rated CVSS 8.8) and some bugs that can bring down the VPN service. Versions listed by SonicWall:

If updating is not immediately possible and SAML is in use, SonicWall’s temporary workaround is to disable the LDAP, RADIUS and TACACS+ servers configured on the firewall.

Barracuda: email gateways targeted through the admin interface

On 2 November Barracuda published an advisory on two flaws, updated on 9 November to confirm attacks against “a small number of organizations”:

• CVE-2026-116606 in the Email Security Gateway (ESG): it bypasses authorization without credentials and allows the appliance configuration to be changed. Barracuda gives it a score of 9.3. The attacker does, however, need to reach the administrative interface.
• CVE-2026-111560: a command injection (score 8.6) also present in Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. Combined with the first one, according to the vendor it gives full control of the device.

Barracuda has distributed patches (for the ESG BNSF-40425 or BNSF-40430, depending on the version) and recommends checking that they have been applied, turning automatic patching back on if it was disabled and limiting access to administrative interfaces to the internal network.

Check Point: from the VPN portal to administrator privileges

On 12 November Check Point described an attack chain against unpatched gateways, observed between 30 October and 4 November (Check Point advisory). Entry was through the PHP2Shell flaw (CVE-2026-109618 and CVE-2026-109619) in the Mobile Access portal, the same PHP vulnerability we wrote about in October. The attackers then exploited CVE-2026-123039 (CVSS 7.8) to gain root privileges on the Gaia system. Check Point reports a couple of dozen compromised systems in a single region; fixes for PHP2Shell had been available since 23 October.

According to article sk1000362 the fix is included in the November Jumbo Hotfixes: R82.20 from Take 14, R82.10 from Take 52, R82 from Take 132 and R81.20 from Take 174. Versions R81 and R81.10, also affected, are no longer supported and should be moved to a current release. Spark firewalls are not affected by CVE-2026-123039, but according to Check Point they are affected by PHP2Shell.

What to do this week

1. Know which device is in the office. Brand, model and version of the firewall, the VPN and any spam filter. If you do not know, ask your IT provider.
2. Update to the versions listed in the tables and advisories above, and get written confirmation of the installed version.
3. Close the management interface to the internet. Firewall administration should only be reachable from the internal network or through a dedicated access. The same principle applies as for the exposed services to check.
4. Check that nothing has already happened. Updating closes the flaw but does not remove an intruder who is already in. Ask your provider to look for unusual VPN logins, new administrator accounts and unexpected configuration changes; Check Point and Barracuda publish specific guidance for this check.
5. Review VPN access. If in doubt, change VPN users’ passwords and make sure multi-factor authentication really works for everyone: see the five levels of login security.
6. Replace devices that are out of support. A firewall that no longer receives updates stays exposed to every new flaw.

We do not publish details on how to exploit these flaws: the goal is to update and verify.

If there was an intrusion: reporting

• Data protection (FADP). If personal data was exposed and the breach is likely to result in a high risk for the people concerned, article 24 of the Federal Act on Data Protection requires notifying the FDPIC as soon as possible. The FDPIC guidelines help assess the case.
• NCSC. For most SMEs reporting to the National Cyber Security Centre is voluntary but useful. Operators of critical infrastructure, however, have a reporting obligation for cyberattacks within 24 hours of discovery.

Frequently asked questions

Our firewall is another brand: can we relax?

Not for that reason. In recent months exploited flaws have hit devices from almost every vendor. The rules stay the same: regular updates, management not exposed to the internet and an eye on the vendor’s advisories.

We have already updated: is that enough?

If the update came after the attacks started, a check of logs and accounts is worthwhile. The attacks on Check Point, for example, began on 30 October.

We do not use SAML for the SonicWall VPN: do we need to update?

Yes. The exploited flaw only concerns SAML, but the same update fixes six other vulnerabilities, including two in the management interface.

Our approach

ElaraTeq Sagl helps SMEs and practices in Ticino check their network devices, plan updates and configure remote access securely (consulting, hosting in Switzerland). To have your setup checked you can contact us.

Sources

• SonicWall PSIRT, SNWLID-2026-0014, SonicWall SonicOS Affected By Multiple Vulnerabilities, updated 9 November 2026
• Barracuda, Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products, updated 9 November 2026
• Check Point, sk1000362, CVE-2026-123039, 12 November 2026
• Check Point, Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation
• NIST NVD, CVE-2026-19868, CVE-2026-116606, CVE-2026-111560 and CVE-2026-123039
• CISA, Known Exploited Vulnerabilities Catalog (additions of 6, 10 and 13 November 2026)
• NCSC Netherlands, Kwetsbaarheden in SonicOS van SonicWall met actief misbruik, 9 November 2026
• NCSC, Reporting obligation for cyberattacks on critical infrastructure
• FDPIC, Guidelines on data breaches